Same Payload, Different Channel: Measuring Trust Asymmetry in Tool-Using Language Models

[2606.00566] Same Payload, Different Channel: Measuring Trust Asymmetry in Tool-Using Language Models Skip to main content Search Submit Donate Log in Computer Science > Machine Learning arXiv:2606.00566 (cs) [Submitted on 30 May 2026 ( v1 ), last revised 21 Aug 2026 (this version, v2)] Title: Same Payload, Different Channel: Measuring Trust Asymmetry in Tool-Using Language Models Authors: Mohammed Sameer Syed , Rozhin Yasaei (University of Arizona) View PDF HTML (experimental) Abstract: As language models take on agentic roles that call APIs, read tool outputs, and act on third-party content, their attack surface expands beyond what users type. Whether they treat a malicious instruction the same way regardless of where it arrives has not been studied systematically. We introduce the Safety Asymmetry Score (SAS), measuring how a model's susceptibility to adversarial content shifts depending on whether it arrives in the user message, tool metadata, or tool output, using matched payload pairs that hold the malicious text identical and vary only the channel. Across 10 production LLMs and three attack families, general-purpose models sharply discount instructions arriving as tool metadata relative to identical instructions in the user message, while agent-native models discount them far less. This differential survives an affordance-matched control equalizing tool availability and scoring, and a size-controlled mixed-effects analysis. Within the tool surface the pattern reverses: the same content is far more instruction-like in a tool's description than in its output, with affordances identical. Models treat tool metadata as instructions and tool results as data. In Llama 3.3-70B and GPT-OSS-120B this signal is causally present at mid-to-late depths but non-linearly encoded, so linear probes miss what activation patching recovers. Comments: Accepted to EMNLP 2026 (Main Conference) Subjects: Machine Learning (cs.LG) ; Computation and Language (cs.CL); Cryptography and Security (cs.CR) ACM classes: I.2.7; K.6.5 Cite as: arXiv:2606.00566 [cs.LG] (or arXiv:2606.00566v2 [cs.LG] for this version) https://doi.org/10.48550/arXiv.2606.00566 Focus to learn more arXiv-issued DOI via DataCite Submission history From: Mohammed Sameer Syed [ view email ] [v1] Sat, 30 May 2026 06:38:41 UTC (51 KB) [v2] Fri, 21 Aug 2026 21:03:14 UTC (74 KB) Full-text links: Access Paper: View PDF HTML (experimental) TeX Source view license Current browse context: cs.LG < prev | next > new | recent | 2026-06 Change to browse by: cs cs.CL cs.CR References & Citations NASA ADS Google Scholar Semantic Scholar export BibTeX citation Bookmark Bibliographic Tools Bibliographic and Citation Tools Bibliographic Explorer Toggle Bibliographic Explorer ( What is the Explorer? ) Connected Papers Toggle Connected Papers ( What is Connected Papers? ) Litmaps Toggle Litmaps ( What is Litmaps? ) scite.ai Toggle scite Smart Citations ( What are Smart Citations? ) Code, Data, Media Code, Data and Media Associated with this Article alphaXiv Toggle alphaXiv ( What is alphaXiv? ) Links to Code Toggle CatalyzeX Code Finder for Papers ( What is CatalyzeX? ) DagsHub Toggle DagsHub ( What is DagsHub? ) GotitPub Toggle Gotit.pub ( What is GotitPub? ) Huggingface Toggle Hugging Face ( What is Huggingface? ) ScienceCast Toggle ScienceCast ( What is ScienceCast? ) Demos Demos Replicate Toggle Replicate ( What is Replicate? ) Spaces Toggle Hugging Face Spaces ( What is Spaces? ) Spaces Toggle TXYZ.AI ( What is TXYZ.AI? ) Related Papers Recommenders and Search Tools Link to Influence Flower Influence Flower ( What are Influence Flowers? ) Core recommender toggle CORE Recommender ( What is CORE? ) IArxiv recommender toggle IArxiv Recommender ( What is IArxiv? ) Author Venue Institution Topic About arXivLabs arXivLabs: experimental projects with community collaborators arXivLabs is a framework that allows collaborators to develop and share new arXiv features directly on our website. Both individuals and organizations that work with arXivLabs have embraced and accepted our values of openness, community, excellence, and user data privacy. arXiv is committed to these values and only works with partners that adhere to them. Have an idea for a project that will add value for arXiv's community? Learn more about arXivLabs . Which authors of this paper are endorsers? | Disable MathJax ( What is MathJax? ) We gratefully acknowledge support from our major funders , member institutions , and all contributors. About · Help · Contact · Subscribe · Copyright · Privacy · Accessibility · Operational Status (opens in new tab) Major funding support from

Related documents

• Same Payload, Different Channel: Measuring Trust Asymmetry in Tool-Using Language Models#665785
• When Agentic Trust Crosses Organizational Boundaries: Structural Externalization and a Reference Model for Trust Evidence#1048357
• Keyword Harnesses Fail Open: A Cheap Diagnostic Ladder for Tool-Use Claims in Small Language Models#1157490
• AgentTrails: Towards Trust and Reuse for Agentic Tasks#386977
• Trusted Model Environment for Private Semantic Computations#1078103